10M people watched a YouTuber shim a lock; the lock company sued him – bad idea | Hacker News Reader

10M people watched a YouTuber shim a lock; the lock company sued him – bad idea

arstechnica.com

1,587 pointsBrajeshwar632 comments

https://www.youtube.com/shorts/YjzlmKz_MM8

> On July 7, the company dismissed the lawsuit against McNally instead.

> Proven also made a highly unusual request: Would the judge please seal almost the entire court record—including the request to seal?

Tough at first then running away with the tail between their legs. Typical bullying behavior.

> but Proven complained about a “pattern of intimidation and harassment by individuals influenced by Defendant McNally’s content.”

They have to know it's generated by their own lawsuit and how they approached it, right? They can't be that oblivious to turn around and say "Judge, look at all the craziness this generated, we just have to seal the records!". It's like an ice-cream cone that licks itself.

> the case became a classic example of the Streisand Effect, in which the attempt to censor information can instead call attention to it.

A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

If you want an extreme example of this; go look at the Sacramento startup Sircles. 7+ year old "startup" that has sub $100k revenue after several years but 9 million in debt. The founder has an account there under u/Sirclesapp where he goes off on toxic and insane tirades to anyone who dares say anything but utmost praise at his app. Apparently he stalks their reddit accounts and sends threatening letters to their personal home addresses from his lawyer for "defamation". That I understand he sent one to some ex employees and one to some woman who I think is a paralegal and is now suing them in civil court.

He partnered with some radio program called radradio where the host had a lot of personal issues and the show ultimately got axed. The radio host was known for having issues with alcohol, but they kept partnering with him because he kept shilling their WeFunder. They've raised over $6m in SAFEs but considering they are $9m in debt, haven't broken $100k lifetime revenue after 7 years, and seem to have over a million a year burn rate, it's doubtful that the shares from those SAFEs (if ever executed) would ever be in the money.

> [...] go look at the Sacramento startup Sircles. 7+ year old "startup" that has sub $100k revenue after several years but 9 million in debt.

Going on a tangent:

Depending on your industry, taking a while to see any revenue is common. Eg look into biotech or the people trying to make atomic fusion a reality.

Debt is just as valid a way to finance your company as equity is. See https://en.wikipedia.org/wiki/Modigliani%E2%80%93Miller_theo... for the theory.

> Depending on your industry, taking a while to see any revenue is common.

That is true. But Sircles, which appears to be just another social recommendation app, is not in one of those industries.

This is cool. Love little tangential info bombs like this. Thanks.

Wow, it seems like the whole purpose of the product is grievance based against yelp. Don’t get me wrong, I’m not a fan of yelp, but I get the vibe that maybe this person would be even more extractive if given the opportunity

I’m from Sacramento and I know of people who worked at Sircles. It’s comically mismanaged and run by a comic book villian.

The company who sued him is, still, embarrassingly, attempting to hold a social media presence, despite getting exposed as fraudsters and bullies:

https://m.youtube.com/@provenindustries8236

> Proven Is so secure that if they detect a robber trying to lock pick they sue them.

Incredible

They also made sloppy mistakes like naming the Proven owner's partner un-redacted in a document they submitted to the court (which is then available through legal search engines). If they were concerned with privacy they could easily have withheld her name.

The one time security through obscurity would have helped them?

That would be more like: shuffling that document randomly between other documents, or using white font on a white page in Word.

Obscurity is often a valid security tactic, just not all the time and never by itself.

Guy who paid someone to throw a brick through his ex wife's window is insensed at being intimidated.

There is delicious irony in the owner of a lock company being so insecure.

> A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

I'm just guessing based on the contents of the article, but it sounds like a typical "hard-fist founder-run company" so good luck convincing the founder to not sit on social media and argue their points.

also known as the 'double down on stupid' and 'triple down on stupid'

We recently had an example of that with Automattic and the WordPress drama. Where the founder was here on HN hurting his own legal case despite people here repeatedly told him to stop posting for his own sake and asking him to talk to his lawyers.

This is known as the “Randy Pitchford” social media strat.

That article just kept getting better and better.

Also:

> “Sucks to see how many people take everything they see online for face value,” one Proven employee wrote. “Sounds like a bunch of liberals lol.”

So when a great product is not a great product, it turns out to be great alone for the fact of being built by republicans.

I think their point was that the lock picking videos were faked. But it’s still a silly comment from the Proven employee.

I’ve also seen people use “liberal” as a literal curse word before. On one “reality show”, a member of the cast broke down while highly intoxicated and started screaming at other people saying:

“You’re worse than a beep! You’re a liberal”

It’s insane just how far the political divide has become.

Othering is easier than improving. An old philosophy professor taught me that at a community college when we started getting on the subject of philosophy in politics. This was probably 20-something years ago, now, but one of the many things that stuck with me from his teaching, and makes even more sense now than it did then.

Surely both sides are responsible even though it only started happening once a certain political figure popped up started calling his meekest opponents murderers and criminals and having crowds chant for them to be locked up

That was probably the final straw for me. Well, one of the final straws. Imagine trying to politicise this.

Yeah, I noticed that. I’d put money on not a single person in this whole dispute being a liberal at all.

Shushh, don't tell people about Streisand Effect.

One thing Proven might have done is to analyze the attack. Then see if the lock could be improved to prevent it. Offer exchanges for the old locks (most of which are unlikely to be requested). Instead they resort to Lawyers, refuse to solve the problem and waste everyones time and money.

This reminded me of Matt Blaze's work on physical lock security back in 2003. He found a method of deriving the "master key" for a building (one key that opens all locks) from a single example: https://www.mattblaze.org/masterkey.html

When he published about this he was bombarded with messages from locksmiths complaining that they all knew about this and kept it secret for a reason! https://www.mattblaze.org/papers/kiss.html

It was a fascinating clash between computer security principles - disclose vulnerabilities - and physical locksmith culture, which was all about trade secrets.

In 'Three Days of Condor', Robert Redford's character locates the hotel room of a professional hitmat (who is after him) by going to a locksmith and asking him "which hotel and room this key belongs to?" and the locksmith asks him "are you in the trade?" and he responds, "No, but I read a lot".

Watched it a few months ago, such a great and under-rated film! RIP Robert Redford

It's a serious hacker film, actually. Redford is the ultimate hacker in that film: social engineering, picking locks, scrambling MaBell's circuits, and taking out the bad guys in the CIA.

[699BB20FD159089A03DD8935575805B1168A8E63 7.4G 1080 blu]

I'm not sure it's really underrated so much as fairly old and not really in the classic canon. (Which may be more or less saying the same thing.)

"Who are you and how did you get in here?"

"I'm a locksmith, and I'm a locksmith."

Police Squad!

Perhaps the most important difference is that software — even after being purchased and used — remains relatively easy to patch, unlike a physical lock.

Tbf that's a new-ish principle. 2003 was Windows XP era and the early days of Metasploit. I.e. Microsoft and all the other companies were still figuring out this internet thing, while most computers were riddled with unpatched vulnerabilities. There was no such thing as zero day back then, because you could use many exploits years later.

But Windows Update was definitely already a thing back then, so I don’t think this “Microsoft was still figuring out this Internet thing” holds.

Software was updated all the time, and it’s much more difficult to do that with locks.

Oh, the bugtraq era, when any grade schooler could download a 0day POC and force remote reboot his classmates' laptops. (I'm told)

Totally true. Also consider that although software can theoretically or technically be patched, sometimes patches just don't exist... the amount of unmaintained but yet useful software is just huge.

It just takes seconds to swap the core on most locks.

Long ago I used to maintain a door lock system. I was responsible for designing a new system to encode the room keys and it became obvious as I worked with the internals that it had a vulnerability that would allow anyone to open any lock from this vendor with the right tool.

When I quietly mentioned this, the response was that everyone knows this but we don’t talk about it.

When Mahmoud al-Mabhouh was assassinated with no signs of forced entry on his hotel room, let’s just say it wasn’t surprising. And no, I don’t think these security flaws are some conspiracy or by design - it’s simply the difficulty of updating firmware on 10 year old boards with a 20 year old design with millions of them out in the field. And they cost around $750 a piece to replace and that was back in 2010.

Securing the room's internal physical latch after the assassination was a nice touch.

There's a reason for the different cultures and information asymmetry: in most countries you need a criminal background check to be a locksmith. But not to operate a keyboard.

Right. I’m in a structured trade right now and learning about _~hF.8f@,8zKub&&@(4’v but we’re not supposed to talk about it. At least they let us use the company computers for personal net stuff.

That only applies to access to modern electronic tools and digital codebooks requiring accounts. Nothing prevented people in the past from buying the physical books used.

When my first house was under construction in 2001, I created my own key from the builder’s key. When I finally moved in, my key would then disable the builder’s key. Curious how this work, I disassembled my lock and found that there were (iirc) 8 keys which would open all my neighbors houses, even after they had moved in and had disabled the builder’s key. Of course I rekeyed my house to prevent that vulnerability, but in theory it remains on all my neighbors. I also didn’t disclose the vulnerability.

I don't know about builder's keys from that era, but modern builder's keys aren't vulnerable to this problem. The builder's key uses a deeper cut on one or more pins, but the owner's key can and should be pretty unique. The only real requirement is that there be at least one cut to a high enough number to allow for a builder's key. There's a good video here: https://www.youtube.com/watch?v=GUCW4OnE6Mc

Maybe they used a master key system instead.

Um, that’s the exact system I was able to defeat. Do a bit more analysis. You’ll figure it out.

"Although a few people have confused my reporting of the vulnerability with causing the vulnerability itself, I can take comfort in a story that Richard Feynman famously told about his days on the Manhattan project. Some simple vulnerabilities (and user interface problems) made it easy to open most of the safes in use at Los Alamos. He eventually demonstrated the problem to the Army officials in charge. Horrified, they promised to do something about it. The response? A memo ordering the staff to keep Feynman away from their safes."

Security through obscurity in a way…

Even as a computer nerd, I find computing culture to be often too radical sometimes.

Agreed

In the long run, transparency always wins

But in the short run it could cause enormous damage if you are irresponsible in your methods.

I once worked for a company that kept its passwords locked in a safe. One day, all other copies of the password were lost, and they needed it, but the safe's key could not be found.

They expensed a sledgehammer and obtained the password through physical modification of the safe using a careful application of force. Some employees complained that meant the safe wasn't... well, safe.

The security team replied "Working as Intended" - no safe is truly safe, it's just designed to slow down an attacker. At that moment, I was enlightened.

I worked on port facilities. Everything corrodes quite quickly, and locks and keys need to be replaced fairly regularly. Once, there was a problem with key management following the replacement of locks on a building containing emergency diesel generators.

The doors were heavy, 45-minute fire-rated security doors, aka "Fucking heavy doors that can cut your fingers just from inertia or wind.".

These doors had to be opened quickly in the middle of the night. There was no locksmith on call, but there were boilermakers. Supports and a chain were welded to the doors, and a T-Rex container mover was used to carefully pull the doors off the building.

The whole operation took less than an hour. Physical security is a matter of time and resources.

However, for good safes, there's a rating on how long it takes.[1] Ratings start at TL-15, for 15 minute resistance against hand tools. They go up to TXTL-60: torch, explosive and tool resisting for 60 minutes. Safes with these ratings will have a metal plate indicating UL testing and approval.

If there are any rated safes on Amazon, I can't find them. A real TL-30 1 cubic foot safe sells for about $2000 and weighs about 500 pounds. Amazon sells something that looks similar for about $100 and weighs about 15 pounds.

There's a separate set of ratings for fire protection, from the NFPA. Fire safes are much simpler. They have more insulating materials and less steel.

[1] https://www.vaultandsafe.com/vault-safe-classifications/

    All Security
    Hinges on the arrival
    Of people with guns

  All security
  is merely a fantasy
  of mortal people.

Thunderbolt and Lightfoot (movie).

Obligatory xkcd

https://xkcd.com/538/

Slow down -- sometimes. But for the most part, locks are more like envelopes. They produce evidence of tampering.

Which is why McNally (the youtube in the title) demonstrating poor locks that can be opened by simple bypass attacks like shimming or whacking is especially damning for those locks. You can always destroy a lock with brute force, preferably power tools. You also spend years honing your lock-picking skills and open any keyed lock in less than a minute, but good locks make this a difficult craft. But shimming a padlock or whacking a masterlock with another masterlock takes no skill, doesn't leave evidence and allows you to relock it when you are done. It defeats every protection the lock was supposed to provide

Yep. There’s a safe engineer on YouTube who was explaining the history of dial combination locks commonly used for government filing cabinets, etc. He pointed out that you can drill them in minutes but you’d need several hours to make good the damage such that the break in wouldn’t be easily detected. The combined time is therefore the ‘strength’ of the security. (Also, why it might be a good idea to have open sensors on safes, cabinets, etc)

> They produce evidence of tampering.

That's why one of the more advanced challenges in lock picking is to minimize the amount of evidence you leave. Eg even a normal pick can leave some scratches on and in the lock in different places than a normal key.

If I remember right, 'bumping' is an interesting technique partially because it leaves even less of a trace.

Yup, I've got a three bolt break in resistant front door in my house, but right next to it is a window that can be breached in .5 seconds by yeeting a brick though it. But both will leave traces if they've been forced so my home owner's insurance should cover any losses / damages.

Most locks are there to keep honest people honest.

From what I remember, the quality of a safe is measured in minutes, with "15-minute" safes being OK for general use.

It kinda fits how I feel sometimes.

Folks come up with some super secure idea for securing my account and I think "Yeah but maybe I forget the thing ... I do still want to access it."

When the theory hits reality with a sledgehammer

I mean theoretically ever the hardest encryption just buys you time. That time may be long past the lifetime of our own sun, but it just buys you time.

The same is true for locks and safes as well.

Being one of the few people who never had their bicycle stolen in a city where this is common, the trick that always works is: Just make your lock harder to attack than other locks that safeguard comparable things.

  Good lock + old looking bicycle = no theft

Unless your stuff is unique and high stakes that means regular criminals won't pick you since the surrounding stuff looks more intersting and is the easier target.

> Good lock + old looking bicycle = no theft

"I parked my old, crappy bike and started locking it. Some guy went past and said, "Don't worry, love - no-one will nick that", and a passing crackhead said "I fuckin' would", and we three strangers shared a moment of humour together. "

I think 'one time pad' encryption can't be decrypted unless you get the key, even given infinite time.

I’d say

  Good lock¹ + old looking bicycle = no theft
  ¹ attached to solid fence or bicycle rack

Excellent koan

reminds me of how a few years ago it became fashionable to say that "walls don't work"

> Under questioning, however, one of Proven’s employees admitted that he had been able to duplicate McNally’s technique, leading to the question from McNally’s lawyer: “When you did it yourself, did it occur to you for one moment that maybe the best thing to do, instead of file a lawsuit, was to fix [the lock]?”

Sometimes a single question tells you how the entire case is going to go.

Back in 2007, I published the first YouTube bypass of the Master Lock #175 (very common 4-digit code lock), using a paperclip.

After the video reached 1.5M views (over a couple years), the video was eventually demonetized (no official reason given). I suspect there was a similarly-frivolous DMCA / claim, but at that point in my life I didn't have any money (was worth negative) so I just accepted YouTube's ruling.

Eventually shut down the account, not wanting to help thieves bypass one of the most-common utility locks around — but definitely am in a position now where I understand that videos like mine and McNally's force manufacturers to actually improve their locks' securities/mechanisms.

It is lovely now to see that the tolerances on the #175 have been tightened enough that a paperclip no longer defeats the lock (at least non-destructively); but thin high-tensile picks still do the trick (of bypassing the lock) via the exact same mechanism.

Locks keep honest people honest, but to claim Master's products high security is inherently dishonest (e.g. in their advertising). Thievery is about ease of opportunity; if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).

Actual thieves don't give a shit to learn lock picking, they can use a fine toothed sawzall or oxy-acetylene torch and defeat any lock just as fast without having to youtube the particular brand.

I used to rent a storage unit. I lost the key to it, and went to the manager. He came back to the unit with a small battery powered grinder. Cut the padlock's loop through in a few seconds.

Most locks are only good if the attacker doesn't have any tools.

I bought a giant pair of bolt cutters a while back for a use case other than bolt cutting (shark fishing; cut the big hook instead of putting your hand near the mouth).

I never caught any big sharks like I thought, but now my wife runs a restaurant and occasionally employees just don't show up to work and leave things in their lockers. Once in a while it's clear it's to be annoying (locking supplies in their locker).

Never met a padlock or combination lock I couldn't shear through easily. Totally has paid for itself.

> Most locks are only good if the attacker doesn't have any tools.

The Louvre security staff similarly just learned this lesson.

For surprise of tool used the saw vs safe are the best:

https://youtu.be/2guvwQvElA8

The main thing locks do is make it noisy to get in.

With these locks you do not even need a grinder, just some really small tools that fits in your pocket, for example a "rake".

See https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ (LockPickingLawyer).

To be fair, a lot of people don't have tools.

Just found out my unit was robbed. The thieves ignored the lock and just destroyed the unit's latch which the padlock secured.

There went Uncanny X-Men 94 through 300.

That's exactly what I've seen too, either a grinder or just a crow bar.

Aha, a legitimate use for those things!

Saw the same, except it was bolt cutters.

That is a subset of thieves. There are still plenty of situations where it is beneficial to have a lock that can't be opened in 5 seconds with a paperclip, like a school or gym locker room for example. Nobody is bringing a sawzall into the gym while it's open.

Similarly, I know the lock on my front door is not going to stop anyone who really wants to get inside, but it does stop drunk people or bored kids from wandering in because it's easy.

> Nobody is bringing a sawzall into the gym while it's open.

They are bringing in bolt cutters to locker rooms. The locker metal loop that the lock threads through is easier to cut than the lock. I've first hand seen lockers destroyed to remove the lock. Not while the break in is happening but it's easy piece the crime scene back together to understand their tools.

Manual bolt cutters are almost silent except for the "thunk" when it breaks the metal, and there are even battery operated bolt cutters that are quick and compact.

Most people would be absolutely astounded how bold you can get with a safety vest and/or a clipboard, and how passive most people are to an obvious suspicious situation.

I have used a grinder to take off a bike lock (I owned the bike) in broad daylight in Downtown Denver on a main street. A local business even allowed me to use their power outlets. Not one person questioned me or asked me to see proof of ownership. I was fully prepared to have to deal with cops or at least a good samaritan, but nope, plenty of people watched me do the exact thing a bike thief would do and didn't ask any questions.

> like a school or gym locker room for example

We broke into our own lockers the whole time with metal rulers back when I was in school because of forgotten keys or just because it was quicker opening them that way than actually unlocking and relocking them. (And of course the more students did this, the more worn the metal became and made it even easier the next time)

Yeah as long as we don't have unrealistic expectations from our $30 deadbolts and our $5 combo locks it's fine. But people sometimes buy the cheap thing and expect it to perform as well as a really expensive thing.

It is actually surprising just how little brute force many semi-decent padlocks can handle. A decent mallet and some force concentrator and I think good amount of them will fail.

I just need to be able to show the insurance company a police report and obvious tampering. On video, someone using an aluminum shim looks the same as someone using a key, and any evidence would require some decent forensics. Same goes for skilled lockpicking and bump-keying. Ideally, the weakest link should be the door, the hinges, the shackle, etc.

Padlocks can be snapped open by angling two wrenches: https://youtu.be/dBSSA5ot0tA

This even works with bigger padlocks, you just need two really big wrenches and a buddy to help you.

I don't think there's much of a point. If the thief came prepared with tools and is willing to make a lot of noise, there's not a ton that can be done.

Without even exotic tools, what are the odds the door the lock is attached to will withstand a crowbar? Or the same mallet and force concentrator applied to the door/hinges/where the lock attaches?

There are diminishing returns. Just look at bike locks. Anything higher than trash tier, and the issue is finding a dedicated bike stand, since anything else will get destroyed by the grinder faster than the lock.

But usually the thing that's locked up can survive even less brute force than the lock -- a storage unit near mine was broken into, and the unit owner (who was there with the police) said the thieves just pried off the storage unit lock, the sheet metal door literally tore and the entire locking mechanism came out.

This was an outdoor unit, the thieves came in over the fence (the barbed wire on the fence didn't slow them), and left the same way. If I had anything valuable, I'd keep it in an indoor unit where at least there's a locked door in the way.

I learned this as a kid: that big, chunky padlock on our garden shed could be busted open by a 10-year-old with a cricket stump and 3 seconds of pulling.

but then it's obvious the locked thing in question had been defiled. To exfiltrate without detection is the real skill

It’s much more difficult to tell if someone bypassed the lock if they picked it (and relocked it), as opposed to cutting it off completely

Which is relevant when you're defending against Ocean's 11 or the Mossad, but for the other 99.999% of us, the lock is there to keep a bored teenager or a meth junkie out.

Or, more realistically, to convince an insurer that we've made a token effort to keep them out.

Actual thieves are most interested in low effort/fast methods of bypassing locks. Master single pin picking to LPL's level and the thief might as well just turn locksmithing into a career instead of stealing. Low effort attacks like shimming, raking, bumping though might be worth a thief's time to learn.

Yes. I once saw a guy open a bike U-lock using a car scissor jack and he was done in about 20 seconds and the bike was gone. Nowadays there are very good battery powered grinders that can take a cutoff wheel and no padlock is going to resist that.

But there are a handful of new U-locks that are quite difficult to cut using angle grinders.

These jobsite storage boxes [0] are typically too heavy to steal (and can also be anchor-bolted), and the locks are highly-recessed within an enclosure... practically the only exposure is the keyway... and then there's thousands of dollars of tools inside.

Worth it for smarter crooks. I'm a former IBEW electrician, and I've seen both stranger and more-miraculous occurrences — but I've seen it all.

[0] https://www.uline.com/Product/Detail/H-10011/Tool-Storage/Kn...

Oh man, reminds me of one project where theives rolled up with a truck, hotwired a forklift and loaded up 3 of these boxes.

Some are still resisting this kind of attacks. The hiplok D1000 has a thick rubber like abrasive coating that makes it super hard to cut through the metal with power tools

I had one of these for my e-bike in Oakland. The thieves used an angle grinder to cut through the bike stand instead

The solution in the east bay seems to be “don’t use a valuable bike”

A battery powered angle grinder with a zip wheel is the best lock picking tool out there. Hell, a cordless Dremel with a zip wheel might do it.

It depends on where you live. I guess it's not uncommon to hear about someone entering a building "as the delivery guy" just to try to pick a lock and see which one opens.

If you make too much noise people will get suspicious and might call the police.

A portable plasma cutter? What is this, Star Trek? Are there some extremely-high-power-density battery-operated plasma cutters available on Aliexpress that I haven't yet run across? Or maybe I should locate my safe far away from my stove/dryer receptacles?

Like muffler fluid, the battery powered welder has gone from a joke to reality recently.

Not a plasma cutter, but same power class, and certainly able to heat a padlock shank to melting. https://www.dewalt.com/product/0447800880/esab-renegade-volt...

You're right, I've mixed them up with portable oxy-acetylene torch, unless they're just backing up to the lock in a pick-up.

You can pick up a wholly self-contained plasma cutter in Lidl or Hofer in their "cool tools week" for about £100 these days.

It wouldn't be beyond the wit of man to hook that up to a biggish inverter and 24V worth of deep cycle batteries on a small trolley, maybe a wheelie suitcase.

Always be red-teaming.

Depends on how portable.

A while back I was making a point about the border wall farce--and found everything I would need to do "portable" plasma cutting on said wall on Home Depot's website. Not pick it up type portable, but put it in a wagon type portable. (Generator, not batteries.)

A plasma cutter needs a pretty decent supply of compressed air

most thieves don't even go that far. they find stuff that isn't locked or they kick in the door.

Entirely depends on what manner of thief we are talking about here, what they're going after, how important it is to them, and how much they care about the owner knowing the lock was tampered with.

This is why I don't like such black-and-white opinions... I think the answer is rarely so simple.

I think it's largely a class or educational divide. I come from a very hick, redneck, working class area. People use black-and-white statements and course language with the understanding that corner cases will exist anyway. My use of this type of language common in more middle America is something I find the more silicon valley or tech centered HN constantly finds issue with.

It's common in more upper-crust / educated circles to shit on people that use more course, black and white language. I believe it has more to do with cultural divide than misunderstanding that rare/corner cases exist.

In another recent exchange on HN, I was damned for using the word 'never.' They didn't even explain why, just said they wouldn't believe people that used it. I was using it in the redneck sense "you'll never get that girl" as in it's extremely unlikely to the point it's hardly worth even considering, rather than the nerded out version that it means the chance is literally precisely 0.

No one is doing that in a nice residential neighborhood

That's when people can get away with it in broad daylight :) Because everyone thinks like you.

Issues with master locks are hardly new- back in the 1980s, I downloaded a file from a BBS explaining how to open a combo lock (basically by pulling on the shackle while turning, and a few other tricks.

It's still online: https://cdn.preterhuman.net/texts/anarchy_and_privacy_contro...

Oh my god, I remember doing this technique on my lock, I remember doing this in the early BBS days, I remember learning this from a short text file. I'm 80% sure it was this file!

Thanks for unlocking this memory for me!

>if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).

If you were stealing from a job site you'd just bring bolt cutters.

You have not ever been on a large enough jobsite, then.

It is impossible to attack the shackle, due to the recessed nature of the locking mechanisms. A torch might work... blasting out the keyway.

But on IBEW jobsites each lockbox contains around $10,000 of tools, within; most thefts are from other on-site trades, and lock-picking means you can blame it on the electricians since there's no signs of forced entry (I'm sure some of the apprentices do steal, particularly the lowly-compensated first semester "greenies").

But the electricians are still paying for it.

The most absurd thing is the original video response from the company was good, and with a very compelling argument: their customers never saw shimming in the field. Their user base don't need shimming resistance: security needs to be adequate, not perfect. And they follow-up by presenting options about people requiring the lock to be shim-proof.

Granted, in this day and age, it's a disgrace to still make locks that can be shimmed. Especially when the shim-proof alternatives they show just have an additional notch to catch the shim.

> their customers never saw shimming in the field.

This is arguably good PR, but a terrible response. Shimming is so quick and hard to detect that even if you had 24-7 video of the lock, you probably wouldn't notice that the lock had been shimmed. You would just assume that someone lost a key.

It's a trailer hitch lock. If someone steals your trailer then you definitely do notice. And if they just shim the lock and put it back then it doesn't really matter.

Also the company sold a picking-proof version… at a higher price.

shimming proof not picking, sorry just noticed the entirely wrong word

This guy shims a $100+ lock in 10 seconds with a liquid death can, all without speaking in the video, just replays and then destroyed their claims and GTFO. Absolutely masterful.

If you don't know him already, I highly recommend videos by LockPickingLawyer — he routinely destroys bogus claims of various companies within seconds. It's quite entertaining to see how little security you actually get from most locks.

I wonder if anybody tried suing him…

LPL owns Covert Instruments, who employs McNally, the YouTuber who got sued in this case. Probably not a coincidence that Covert Instruments wasn't named in the lawsuit.

I wonder if McNally knows a lawyer familiar with lock picking ;-)

Oh sweet never knew there was a connection between LPL and McNally - I just notice they always cut their shims from cans the same way

That explains so much. Done to well for a goof channel, eclectic assortment of skills ("tactical garden trowel" vs fully equipped metal shop vs perfect video production), all fat trimmed off the videos.

I kinda want tvtropes to put a name on his slapstick humor. It's like looking over the shoulder of that weird uncle that seems to live in an entirely different world.

In addition I've seen LPL refer to "my friend Trevor McNally" in a couple of videos.

> Probably not a coincidence that Covert Instruments wasn't named in the lawsuit

What's the non-coincidence?

> he routinely destroys bogus claims of various companies within seconds

I watched his video on high-security shipping container locks. Jeez, two minutes long? They must be tough!

No, it was two minutes long because he bypassed ten of them, one after the other.

My impression of most locks now is that they're really just to stop something from being casually broken into or even just falling open by accident.

My dad's wisdom as he cut my bike lock off when I lost the key in middle school: "locks keep honest people out."

I've watched LPL videos and practiced on regular locks, I can pick something that is about 10$ or less, but these expensive locks with good tolerances (Abus) or disc detainer cores (kryptonite locks,) no amount of practice and fiddling with the correct tools has ever opened one of these. I lack the skill or touch.

I can hold a 18v grinder with a cutoff wheel just fine though, I lost the keys to one of those kryptonite locks on my bike and I was riding my bike again 30 seconds later.

Or to make it clear that if someone does break the lock, they didn't have your permission to get at whatever it was protecting.

you are adjacent to the concept that locks are an honest persons way of communicating to other honest people that an invitation is required.

This one? https://youtu.be/_goIYP3FfO8

That’s McNally rather than LPL.

Can he pick an Assa Abloy lock though?

LPL is a crown jewel of YouTube. His April Fools' Day videos are hilarious, too, like the one where he gets into his wife's beaver [0] (SFW).

0: https://www.youtube.com/watch?v=TRozAbaKs9M

The Dutch translation is NSFW though as it translates “beaver” as suggested.

> It's quite entertaining to see how little security you actually get from most locks.

Yeah, one of my conclusions after years of watching LPL is ironically to start buying cheaper locks.

The difference between a $3 and a $300 lock is just about a minute of time for an experienced lockpick. No lock is capable of dissuading a determined thief, but any lock is equally capable of dissuading a lazy one.

The best policy is to have a lock that is resistant to cutting and destruction, with a trivial key. Nobody tries to pick a lock, and if they do, they're winning. Most or all breakins happen through brute force not technical sophistication, so a decent chunk of metal is a fine adaptation.

I use the locks my insurance company recommends. That's who it's there for anyways.

The other side is "career" thieves will know how to pop-can shim a lock but most of them are not going to use or break out a set of picks. One main reason it's an additional felony charge if you get caught using them. So a _slightly_ better lock is sometimes warranted for outdoor applications.

The final piece is they'll just steal a car and then drive that car through your shop front to get what they want. Up here in Northern California a gang pulled off the same heist as the movie "Casino." They drove a van up to a wall and then knocked out a small segment of the wall to gain entry.

>The difference between a $3 and a $300 lock is just about a minute of time for an experienced lockpick.

How about non-experienced lockpick? Or the one who gonna brute force everything? I think there's value is expensive lock (Assume you buy the high quality one, not the over-price one)

Yep. The low hanging fruit principle in action. You can’t make anything completely secure so you put up more obstacles than your neighbor so the attackers go visit the neighbor instead.

Or in the case of targets with no neighbors like missile bases, you know approximately how long it might take an attacker to succeed, then put big guys with guns within that distance measured by time.

I'm considering an angle grinder resistant lock for the bicycle. They are not totally uncuttable but it means you have to be stood there for a couple of minutes changing worn cutting disks and the like. Quite expensive though.

I came to the same conclusion with my bike. What's the point of an expensive and heavy chain lock, when the thief will break or bypass it anyway.

So I just fot a cheap wire combination lock, just so you can't just jump in the bike and ride away.

LPL is superb. He inspired me to get a lock pick kit and a few simple padlocks - a cheap and fun hobby during COVID lockdowns.

I picked up and started practicing with Lishi lock tools, and I cannot recommend them enough. Pocket Tool Warehouse out of Texas has been good in my experience for sourcing them, no affiliation. Like an automatic transmission for lock picking.

https://www.classiclishi.com/about/lishi-history

https://www.originallishi.com/what-are-lishi-tools

Ditto. I was even able to put my lock picking skills to use one fine summer day when the dog park was locked due to "rain from yesterday" even though the grass and everything was clearly fine. We had a lovely time running around as a family, along with a couple other families, for about an hour before the groundskeeper came and shooed us away.

Thinking of doing the same! Which kit did you order? I see a FNG, FNG+ Bundle, and "Learn lockpicking bundle". 3rd one seems the most likely candidate. Any tips you can share? Thanks!

Same here. It also inspired me to teach my kids. Watching my nine year old daughter pick a lock warmed my subversive little heart.

Putting the lock in lockdown I see.

> It's quite entertaining to see how little security you actually get from most locks.

Physical locks are for honest people. They signify that something is not meant to be accessed and at best slow down someone actively trying to access the other side of the lock.

I recall either "The lock picking lawyer" or McNally explains that only in 3% of cases are locks picked during a burglary. In all other cases windows or doors are simply forced open. So at best locks are meant to prevent of crimes of opportunities.

They're also effective against incompetent thieves. Anecdotally that's a pretty high percentage of thieves you'll ward off that way.

I think that it's more useful to think of all defenses against physical intrusion as increasing the cost of intrusion in some way, be that time, skill, risk of being caught, access to specialized devices, etc.

Most "normal" locks don't increase the cost too much but they do raise it - perhaps enough for a thief to pick another target, or perhaps enough for the thief to choose another method of entry such as kicking in the door (which itself comes with additional risk of detection).

It requires a fair amount of skill to pick a lock quickly. Someone capable could probably make more money doing something legit.

Security is about layers. If I have a basic lock, all I want to do is stop an opportunist.

I have a vehicle that is extremely simple to steal (you can unlock everything with a screwdriver), to protect it I use both a pedal lock, a secret second key and a steering wheel lock.

Will it defeat a determined thief or a team of thieves? No way. However it will put off most opportunists and slow down a more experienced thief enough that they may choose another target.

And even still, whenever I or a friend has hired a locksmith, they try for 5-10 minutes with no success and drill thru the lock destroying it.

Don't know why you are being downvoted because it's true. Lots of people wouldn't try to break past a lock but if you leave a door open many people would fall for the temptation.

If a lock takes more than 20 seconds to break it’s basically Fort Knox

No one would be surprised if you showed that you could cut a hole in pretty much any normal door given the right cutting tool. Yet people seem to act surprised and betrayed to learn that a normal lock can be picked or broken given the right tool.

Are there any that are truly secure?

The fact that he is actually a lawyer probably helps greatly, both in terms of what he can legally do, and as a deterrence to others trying to sue.

This also works on places like HN. I will often make an argument in my normal, working class low educated redneck hick sort of writing style. People will assume I have an unsophisticated basis for my argument and are way more likely to debate me on it. They like to attack an 'easy' target and even better if they are culturally seen as different.

If I use my pretend upper well-to-do white guy rhetoric with precise and deep vocabulary, I can make claims with a lower likelihood someone will challenge it, even if they are equally well backed.

Opening a padlock by hitting it with another padlock has to be one of my favorite bits.

"This is a Master Lock XYZ. It can be opened with a Master Lock XYZ."

Great channel, and yes the ineffectiveness of nearly all commercially available locks is depressing. At best it would briefly slow down a skilled picker.

https://youtu.be/qL_MeobAp5s?t=1487

For those interested in the actual case, here's some deeper coverage of this bruhaha including how Lee may have perjured himself during deposition.

That guy sure isn’t in a hurry to get anywhere. Good one to watch at 1.25x speed.

One of my favourite lock pickers is Marc Tobias. He was also sued by a number of lock companies.

https://www.youtube.com/watch?v=NadPAE6BDbA

It is interesting to see that these companies still don't know about the Streisand Effect or they choose to think that it won't happen to them.

He just dropped a new video. Totally roasted the cunt out of that Easilok: https://www.youtube.com/watch?v=3lS5_6D4q9k

If a company’s first reaction to a flaw is to sue instead of fix it, the problem probably goes beyond the lock itself. A real security company would appreciate someone pointing out a weakness rather than trying to take the video down. That kind of openness would actually make people trust them more.

The weird thing is, they actually had someone competent dealing with the issue:

> The strange thing about the whole situation is that Proven actually knew how to respond constructively to the first McNally video. Its own response video opened with a bit of humor (the presenter drinks a can of Liquid Death), acknowledged the issue (“we’ve had a little bit of controversy in the last couple days”), and made clear that Proven could handle criticism (“we aren’t afraid of a little bit of feedback”).

> The video went on to show how their locks work and provided some context on shimming attacks and their likelihood of real-world use. It ended by showing how users concerned about shimming attacks could choose more expensive but more secure lock cores that should resist the technique.

Sounds to me like someone professional in the company with a cooler head was on this and was handling it well, but someone else higher up got angry and aggressive and decided that revenge was more important.

Lock-makers should start including RFID and a software key checking mechanism, then sharing the key would be illegal

Here in Finland mechanical locks with electronic keying are pretty common in some places. Some of them like iLOQ or Abloy eCLIQ are actually pretty clever: electrical bits of the lock are powered from mechanical action of inserting and turning the key, so you don't have to worry about batteries. In theory, they promise significant cost savings in scenarios like rental apartment buildings where tenants move in and out, need access to common areas, lose keys, etc, without compromising security or having to replace or recode locks - they just give you a generic key, click some buttons in the admin panel, and your key could be provisioned accordingly once you first enter the building and interact with one of the "smarter" locks that are externally powered and networked to the mothership.

In practice, in addition to the usual bugs you would expect from a software-based system managed and maintained by a plethora of organizations and contractors, they tend to become very annoying as parts wear out, so you have to fiddle with the key reinserting it repeatedly trying to find just the right angle so it will make a good contact to be recognized by the lock (for example the iLOQ system by my landlord communicates over a thin contact strip molded into the key opposite of the cutting and separated from the rest of the key with a thin layer of plastic).

Sounds about right for Abloy. They own Yale and their app-based alarm is subcontracted dogshit (by https://mobilepeople.dk) that didn't get updated for years on end, logs you out constantly, has less functionally than a 90s keypad model and even the hub thing sometimes just falls over and needs a power cycle, etc etc etc. Presumably they are entirely unable to handle any of it in house and are at the mercy of the contractor to fix anything.

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

That's an illegal number mate. Straight to the slammer!

(for those missing out: https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...)

Thabk you so much this is a beautiful rabbit hole to go down

plz stop! my hddvds...

Could you make access illegal using the DMCA, by putting some copyrighted content inside, with the physical key also being the license key?

This is how Nintendo engineered a legal argument disallowing 3rd party cartridges original GameBoy. The cartridge needed to display the Nintendo logo on startup which was checked pixel for pixel, otherwise the GameBoy wouldn't proceed with booting. Third party carts couldn't do so without infringing trademark.

Note that the courts ruled this technique invalid in Sega v. Accolade: https://en.wikipedia.org/wiki/Sega_v._Accolade

But that was in a pre-DMCA world, before the anti-circumvention provisions gave these companies more legal weapons to criminalize fair use and competition.

What criminal mastermind could possibly defeat the DMCA? :D

> sharing the key would be illegal

How so? And what region are you referring to? There are many countries in the world with vastly different laws.

Unfortunately, the "region" would be the 193 member states of WIPO: https://en.wikipedia.org/wiki/Anti-circumvention

So, you are right, the laws in Micronesia, Palau and South Sudan might be vastly different.

I don't really "get" locks. If you want something to be closed forever, seal it shut. If it should be opened and closed, leave a hinge. If it should only be open and closed by a select few, leave it in a trusted environment

Don't you live in a good neighborhood?

I've lived in a fair few places, but I've never lived in a place where an unlocked bicycle wouldn't be stolen. I'll keep using locks, thank you very much.

I think they were probably making a joke about software security.

A trusted environment, even in a "good neighborhood", requires a lock at least to the front door of your house, or gate, or w/e.

But where will you park your car when you go to work? You have to lock it.

> A trusted environment, even in a "good neighborhood", requires a lock at least to the front door of your house, or gate, or w/e.

I don't think that's a trusted environment or "good neighborhood". But then I basically use "can leave front door unlocked with zero worries" as the threshold for "trusted environment".

But those environments and neighborhoods definitively exists today across the world, although they're probably becoming less and less common.

> Lee’s partner and his mother both “received harassing messages through Facebook Messenger,” while other messages targeted Lee’s son, saying things like “I would kill your f—ing n—– child” and calling him a “racemixing pussy.”

Some people always go too far, undermining the good cause of the others

This reminds me of the CEO of a cyber security company that challenged Anonimous https://en.wikipedia.org/wiki/HBGary. If you work for any kind of security company, do not ever ever ever challenge any kind penetration specialist. Everything is hackable, it is only a matter of cost vs reward, but when you challenge someone that goes out of the window.

Generalizing the advice..

Don't challenge people. Don't insult people. Don't humiliate people. Don't threaten people. Allow them to maintain their self-respect even when they lose. Don't rub it in. Give them a face-saving exit.

Plenty of violence and aggression is caused by violation of the above rules. They seem simple but they're broken on a daily basis. Famous last words: "you don't have the guts".

The whole case is up on RECAP:

https://www.courtlistener.com/docket/70036390/proven-industr...

I wonder how many stories like this are caused simply because a corporate lawyer is looking for some work to do, and maybe to meet some kind of internal KPI.

Former in-house lawyer here and in my experience the answer is something like "probably less than you think." The job of the lawyer is to advise the client and (within the bounds of ethical rules) advocate for their position, not to come up what the company's position should be.

Honest question.

Is it the job of an in-house lawyer (or any lawyer) to say that this appears to be a vexatious or SLAPP case, and the client should not pursue it?

Is there an ethical obligation not to get involved in a case that you know is being prosecuted in bad faith?

Within the limits of their knowledge/ability, yes. Some bosses make it clear they do not like being told no, however. YMMV if you continue to work for such people.

The bar there is very high. This case might be embarrassing but probably isn’t sanctionable. And the only lawyer that would get sanctioned would be the ones that signed the papers not the drone that hired them.

Interesting, thanks for the insight!

If anyone is interested in the legal side, I'd also recommend 'Runkle of the Bailey' who has a series on this saga but with a focus on the legal shenanigans [0]

[0] https://www.youtube.com/watch?v=y3WVme9LAcQ&list=PLo0bMOObfk...

The internet : sees thoughts challenging facts

Someone : “Sucks to see how many people take everything they see online for face value,” one Proven employee wrote. “Sounds like a bunch of liberals lol.”

The company : Proven also had its lawyers file “multiple” DMCA takedown notices against the McNally video, claiming that its use of Proven’s promo video was copyright infringement.

When did facts and enlightenment started to be for "liberals lol" ?

Freedom of speech based on facts should be universal.

"Reality has a well-known liberal bias."[0]

0: https://youtu.be/IJ-a2KeyCAY?si=cIcawm3U5-55nI2D&t=252

I just saw grokpedia results, which include a gay-free description of gay novels (Banana Fish) and forged or curated accounts of war on Iraq, Thatcher and Duterte.

So yeah, reality is liberal nowadays

They're all a tough guys act. It's the type. Many American men love playing soldiers. What is Liquid Death? It's water LOL. See?

I like liquid death because their water is delicious and not high in sugar. I usually drink a sparkling water with dinner and I definitely prefer liquid death over la croix. They are technically different products though.

That their marketing is so edgy is just fun. I don't take it seriously, and it doesn't seem like they do either.

But Proven is definitely full of toxic masculinity internet tough guys.

FWIW in my experience is less the monster energy / black rifle coffee audience, it's actually the red bull / white claw audience.

It still feels wrong to me, but that's how it is.

> When did facts and enlightenment started to be for "liberals lol" ?

It didn't. That's one employee of the company, who has a clear bias in the matter, being ridiculous. It has nothing to do with liberal ideology, nor critique of liberal ideology, nor whatever sort of person that employee thinks should be considered a "liberal", nor their ideology. It's only the employee who even suggests that, and probably not even seriously.

>Freedom of speech based on facts should be universal.

To be fair that's not what we have in USA. For instance, a nurse who never even signed a private privacy agreement with anyone (unusual, but could happen) could violate HIPAA if they factually tell a patient's spouse the patient is being treated for AIDS and they ought to watch out.

Yes, they could and most definitely would be. The case you describe is one of the reasons it’s that way.

For what exactly would this fly-by-night nurse be telling me to “watch out,” in relation to my partner who’s living with and being treated for HIV?

One hopes this nurse, being medically trained and apparently working with vulnerable populations, understands the efficacy of the modern HIV therapies the patient is receiving. That, when managed, HIV is not transmissible by conventional marital means [0]; and that, until recently at least [also 0], concerted public health efforts have meant that most anyone who seeks medical attention ends up on those modern therapies.

That said, I hope said nurse would catch me in a charitable mood rather than a litigious one.

[0] https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta...

How could that happen exactly? In what circumstances could a nurse end up working for (or even volunteering for) a HIPAA covered entity without signing a privacy agreement?

The entire field of locksmithing has a failing culture around security. They still rely on security by obscurity, they sue attackers, and they never improve

I am concerned about the public reacting aggressively agaisnt the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit, however unjust it was.

The correct support for a just cause must have been constructive: providing financial support for the defendant, public manifestation campaign, professional lobbying, etc

Although this time I agree with the defendant cause, the response by the public was as toxic bullying as the plaintiff, only stronger.

That’s the internet these days. It’s been going on for decades. Game developers got death threats over minor changes to video games and nothing happened to them. Is it that surprising that tactic has continued?

People can make fun of the company all they want. That’s fair game. They shouldn’t be calling the guy’s personal phone or harassing his family, that’s totally over the line.

But nothing happens. The behavior gets a pass so it continues to become more common. That passes for debate now.

Phone numbers are public not personal secrets. If you have a number someone can call it.

And I can find relatives/friends on Facebook to harass. Doesn’t make it ok.

Just like the fact we have agreed upon rules against using chemical weapons or attacking civilians in war (which some violate), the fact something is possible doesn’t mean society should accept it.

If we don’t have even the basic civility of not getting death threats over whatever minor thing someone on the internet is mad at, even mixing us up with their real target sharing our name, what’s left?

Everything becomes full force win at all costs, no matter how stupid or trivial. Who wants to live like that?

To be clear, threatening people in person is against the law too.

Let's all say it together: just because you can doesn't mean you should

This all sounds great in the abstract. But reality is different due to the power differential. McNally is just one dude (albeit with a huge following). Lee is obviously a toxic jerk and his attacks and mockery of McNally triggered both McNally repeatedly proving the flaws in Proven's technology.

McNally obviously did the correct thing it seeking counsel and basically demolishing Proven's case in court. Too bad the SLAPP stuff doesn't work with DMCA takedowns.

And everyone else cheering on the sidelines (who isn't a paid shill of Proven's like the guy making the "liberal" comment)? Well giving Lee's company shit is fine IMHO. Call up the publicly available phone numbers, make service requests to flood his business etc. Fine with me. You poke the Internet bear, you get some claws.

As to the threats? If they actually occurred (which is questionable considering the BS Proven has been saying), then let the authorities know about them. That's not on McNally at all, it's more Lee being a jerk who doesn't know about the Streisand Effect, combined with social media companies that allow stuff like that to happen. It's also a good idea to not expose too much info about your personal life on social media that can be linked to your business, opsec ya know?

> the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit

I think you're confusing who filed the lawsuit here. That was also the lock company owner as well (Lee/Proven).

While I agree that flash mob harassment from the Internet is a terrible dynamic, filing baseless lawsuits has been a longstanding way to predictably summon them. So if the table stakes of launching or defending these type of aggressive attacks have gone from a significant amount of money for attorneys, to a significant amount of money for attorneys plus public relations and/or having a large audience, does that really actually change much? Either way most people simply don't file lawsuits, even if they've been actually wronged, due to the extreme personal stress.

The straightforward way of diminishing mob justice is to make people believe the system provides justice. If we lived in a society where McNally would predictably win the lawsuit [0], and be predictably compensated for his expenses/time/emotionalDistress for being on the receiving end of this baseless SLAPP, then there would be much less mob outrage to begin with. As it stands, everyone can imagine themselves receiving these types of legal shakedown letters, but having much less power to push back.

[0] it sounds like this particular suit was slapped down pretty hard and "quick" by the standards of the legal system, but there are many similar cases that don't go this way

You’re getting downvoted which is unfortunate because I think you make a worthwhile point.

Emotionally I disagree with you. It feels like a bully is getting what a bully deserves. Logically, I think you are right though. Crowds just aren’t equipped to handle these situations. There are cases where the wisdom of the crowd is correct, but there are many more where it multiplies harms.

The underlying problem is that it never feels like justice is being served. Another comment mentions that there should be harsher punishment for false DMCAs. I don’t think the “wisdom of the crowd” approach is the best way to write those wrongs but I lament that modern justice has not been up to the task.

I’m going to border closely to blaming the “victim” here, but if the lawsuit had been filed without toxic, threatening, man-baby social media posts, we wouldn’t be hearing about it. Harassed because he filed a lawsuit? C’mon, there’s a lot more to it than that. When one goes swinging their dick around on Twitter in an attempt to garner support (from one’s equally toxic fans, I presume), one will also likely attract equally toxic folks who disagree. Talk enough shit, and you’ll eventually get a punch to the face. Right or wrong, such is the world long before social media.

It's probably a good thing for Proven that they didn't get into this dispute the LockPickingLawyer instead. He'd wind up owning their company in the counter-suit...

That'd be an interesting channel, the "LockMakingLawyer" where the lock is highly lawsuit resistant, "Press the NDA button to always be informed when the next video comes out"

Once came back to work after 4 week holidays (not USA) and realized I forgot the 3 digit code to my locker.

But I remembered that friend's locker (he was on holidays then) used US police code for murder. (Police in US use codes for crimes when communicating on the radio).

I googled the code, used friend's locker for the day, and by lunch the next day I've bruteforced through enough codes to learn that my code was the embarrassing 420.

https://youtu.be/PVhYhLQ4Y64?si=5UrMMeovCkP2J3Nr

Haven't laughed so much reading an article recently. Wow, this story looked taken right off a comedy movie.

The company who sued him is, still, embarrassingly, attempting to hold a social media presence, despite getting exposed as fraudsters and bullies:

https://m.youtube.com/@provenindustries8236

So... what should we be using for physical security?

The question is "what do you want to secure against?" Describe the threat and then go from there. What are you securing? Is it meth-head or teenager? Or is it person determined to get in while making your insurance grill you over "did you lock it?"

In the case of a trailer, you do some combination of...

- Receiver pin lock similar to the one highlighted here (but probably not that exact one) - Wheel lock / boot - Receiver coupler lock (locks inside the cup-shaped receiver, preventing somebody towing the trailer with an undersized ball) - Secured storage lot / garage

But, basically all options are only going to stop random opportunistic thieves. If somebody really wants whatever you're protecting, they'll find a way. That's why insurance exists.

Just clicked around after watching the vid and stumbled onto [0]. So there are locks he recommends... When it requires focus + several minutes to pick.

[0] https://www.youtube.com/watch?v=HrV86GqlY8o

I do lockpicking and swear by "Abus" locks

Long (often an hour long) with significant snark videos going over the filings: https://www.youtube.com/@RunkleOfTheBailey/search?query=Prov...

Someone seriously needs to be taken to task for filing a false DMCA. DMCA is just another term for SLAPP these days. If anyone is a lawyer, they could still be despite retracting the case?

Anti-SLAPP is a great tool to have, but we do need slightly stronger ones. It’s a tough balance to find - to minimize the potential ways to abuse the system for all different kinds of entities/people.

YouTube’s TOS would be the most critical place to begin in terms of evaluating legal options. To file a “DMCA” (not really DMCA but YT’s proprietary version of it) claimants generally have to create an account and agree to the TOS. So it may bind both parties (the YTer and the abusive DMCA claimant). That might limit legal options for anti-SLAPP, tortious interference, etc.

But without either significant legal expertise or someone finding some particularly relevant case law, it seems like a nuanced enough domain that no one’s lay “legal” opinion would be particularly illuminating.

As the recipient of a SLAPP lawsuit (~decade ago) for truth I published online, the biggest problem with Anti-SLAPP statutes is that laypeople (particularly poorer ones) have limited access to attorney representation... the judicial system isn't accessible/friendly to the pro se litigant.

So even if the case is clearly being used to strategicly silence you, it'll probably still work (from plaintiff's POV). Same for DMCA.

My pitch for an improved system is to give defendants the opportunity to file a lawyer-less motion for summary dismissal, which is 1) geared towards being filled out by a layperson and 2) doesn't disqualify you from a subsequent filing for summary dismissal once you get a lawyer. Basically, an initial "this is a stupid lawsuit, here's why" type deal.

And then fine plaintiffs (and pay the defendants) that lose a summary dismissal, because if your case can be thrown out before trial, it was a shit case that should have never been filed in the first place.

The real problem with DMCA is that in theory it's under penalty of perjury, but in practice it's completely ignored. What is really needs is statutory damages for bogus takedown requests.

Part of the problem with the DMCA is that the "perjury" clause only applies to "claiming that some IP exists", not "claiming that this violates the IP".

Sounds like the guy had rude awakening that his lock wasn’t as good as he thought it was.

Another way of responding to this is… to improve the lock?

Could even explore a positive collaborative social media campaign promoting the new lock.

Ship has sailed now…

There were locks that were secure against this attack, but they're more expensive. The cheaper locks vulnerable to this attack probably still makes them a load of money, though.

Suing someone because your product doesn't work correctly is diabolical. Instead of filing a lawsuit, they should have acknowledged the issue and released an upgrade to their locks.

Ah, but the truth came out here; the can't sell a lock that is upgraded, because they already do sell one at a higher price.

There are cheaper locks if you don't care to defend against shimming.

LPL (Lock Picking Lawyer) has been making a fool of MasterLock and other physical security products/marketing for many years.

Guess ML realizes it’s best to be humiliated online where a small subset of population would never buy their products anyways. Rather than humiliate themselves in public like Proven Industries did (Barbara Streisand effect?)

They turned a one-minute critique into a PR disaster that millions of people now know about

Yeah saw this - I can't believe a company would steer so far wrong...

> Proven argued that it would be difficult for an untrained user to perform.

That’s are exactly the people who usually break locks. All others fail on simple locks too.

The wohle article reads to me like: "AMERICA FKK YEAHHH BROO, HE GOT PWNNNDD, SON!" eagle sounds

Gotta admit its entertaining, though.

These kinds of results seem all too common. Like, why? Are companies just too used to using their general business attorneys for it, and those attorneys are just ignorant? Hungry for extra billable hours?

> Like, why?

The answer, as succinctly as possible: cognitive dissonance.

This is exhibited in every human endeavor, but it's particularly acute, or at least more apparent to simple analysis, in business. In business, anything that diminishes the perception of value is a threat to earnings. Business people don't tolerate the existence of such perceptions in their minds. They readily adopt whatever mental state is necessary to deny realities that reveal a lack of value in whatever work product they sell.

In this case, someone demonstrated a weakness in a lock design. In the minds of the business people behind the product, this is impossible. Their locks are awesome. Best locks in the world! Therefore, the only conceivable possibility permitted, in their minds, is fraud or some other actionable offense that can be feasibly pursued in court.

The role of lawyers in this is a symptom, not a cause. Lawyers are paid to exhibit the necessary cognitive dissonance their clients require. Whatever aberrations or iniquities arise from this are simply denied by yet more cognitive dissonance.

> Lawyers are paid to exhibit the necessary cognitive dissonance their clients require.

Thanks for answering this FAQ.

While IANAL: even people who have done wrong deserve to be treated fairly. "Cognitive dissonance" has nothing to do with representing someone.

Businesses don't have to delude themselves to succeed either.

Even if they know they would lose in court, lawsuits are expensive enough that threatening to sue or filing a lawsuit is often enough to get people without deep pockets to do whatever you want.

I don't know if that was the reasoning in this case though, considering that they didn't drop the lawsuit once it was clear that the youtuber wasn't going to give in to their demands.

Interesting story but surprisingly bad write up. What happen to arstechnica.

It would be funny if all this was just a liquid death marketing campaign

Who knew shaking a juice box could be so intimidating!

Saw the headline, knew it was going to be McNally.

God Bless McNally

clearly proven needs to sue whoever initiated that lawsuit for "mockery produced for the purpose of humiliating plaintiff”.

so they were even asking for it themselves? ahah, geniuses

OMG

Wait, what if a hacker found an exploit and then published it without giving the company a chance to fix it?

What a snowflake.

Um...shouldn't Proven just hire Trevor McNally as a consultant or heck, make him a partner? I mean...can you imagine the next level reputation they'd have if they can adapt and make a Trevor-proof lock?

I'd buy it.

This is the stupidest thing I read today.

> In the end, Proven’s lawsuit likely cost the company serious time and cash—and generated little but bad publicity.

There's no such thing as bad publicity. People say this for a reason. It's true. I'm willing to bet that their sales have only increased since this started.

There's absolutely such a thing as bad publicity. Entire products and even companies have tanked because of bad publicity. I don't know why this myth continues to be so prevalent.

I think the saying is for people who can take the bad publicity and use it to their advantage.

You're right! I'm off to the next Fyre festival and making sure my bag is secure with a Proven lock..... I wonder if Dassani still exist so I definitely can quench my thirst.

I didn’t buy a Juicero back in 2015. Seems like I was not the only one.

Bad publicity doesn't guarantee success for a bad product. But it doesn't doom a good one either.

Who is in the market for a product that doesn't work as advertised?

Lockpicking youtubers? But I guess that market got exhausted early on.

Humane Pin?

Reply on news.ycombinator.com